zoom-meetingnow[.]us

On July 25, 2026 analysts observed that the domain zoom-meetingnow.us was registered on March 14, 2026 through NameSilo, LLC. The site resolved to the IPv4 address 104.225.130.131, which is advertised as belonging to Shock Hosting LLC (AS395092) in the United States. The TLS certificate presented by the host is issued by Let’s Encrypt with the R13 identifier, indicating a recent automated certificate issuance. The page title returned by the server reads "Zoom Meeting | Secure Video Conference," suggesting an attempt to masquerade as an official Zoom meeting invitation. The server stack includes LiteSpeed web server, Tailwind CSS for front‑end styling, and HTTP/3 support, all of which are commonly observed in malicious phishing infrastructure.

DNS resolution is provided by four authoritative name servers (ns3.loominost.com, ns4.loominost.com, ns7.loominost.com, ns8.loominost.com). VirusTotal analysis shows that two of ninety‑four scanning engines flagged the domain, confirming a non‑trivial detection rate. The domain is currently listed on three public blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL, leading to an offline status at the time of reporting. No additional intelligence such as Safe Browsing verdicts, OTX references, or detailed payload characteristics is publicly available.

Given the available evidence, defenders should continue to block zoom‑meetingnow.us at perimeter devices, update intrusion‑prevention signatures, and monitor for any related C2 infrastructure that may share the same IP range or name server set. Incident response teams should also consider scanning internal logs for DNS queries or HTTP requests to this domain prior to its takedown, as the short lifespan typical of phishing campaigns may have resulted in limited exposure. Ongoing observation of the associated IP address and hosting provider is recommended to detect potential re‑use of the infrastructure for future campaigns.